{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T15:58:31Z","timestamp":1783007911013,"version":"3.54.5"},"reference-count":47,"publisher":"Association for Computing Machinery (ACM)","issue":"4","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Distrib. Ledger Technol."],"published-print":{"date-parts":[[2026,12,31]]},"abstract":"<jats:p>Blockchain is a distributed ledger technology that provides pseudo-anonymity among participants to maintain privacy. However, malicious actors utilise this property to hide their illegal rewards received through cyber attacks, dark market trades, money laundering and Ponzi schemes. The recent confiscation by the FBI of more than $4 million USD worth of bitcoin from the \u2018Silk Road\u2019 dark marketplace indicates the scale of the problem faced by financial regulators and law enforcement authorities. Analysing and identifying harmful actors is, therefore, necessary to regulate the transactions of digital assets. Machine learning models can assist in detecting patterns and correlations between the actors in blockchain networks that may not be apparent through traditional methods. In blockchain networks, the number of actors linked to illegal activities is significantly smaller than that of regular activities. Also, only very limited labelled transaction data is available about these malicious actors. These limitations make it harder to train supervised learning models to provide real-time proactive responses. This article represents a pioneering effort in thoroughly examining the different unsupervised learning methods for clustering suspicious behaviour of actors within blockchain networks. The proposed unsupervised learning-based analysis considers metadata and interconnectivity information of blockchain transactions. The metadata contains time-based and amount-based information. Interconnectivity data represents centrality measures and embedding vectors of the blockchain network. The quality of the identified clusters is validated using internal and external cluster validation measures. The validation results were used to identify influential features using the eXplainable AI technique Shapley (ShAP) values. The results reveal that the features related to the spending and receiving transactions strongly influenced cluster identification. Overall, the centroid-based and connectivity-based approaches identified well-separated clusters for metadata and centrality-based features of blockchain transactions.<\/jats:p>","DOI":"10.1145\/3773277","type":"journal-article","created":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T14:47:49Z","timestamp":1761576469000},"page":"1-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Identifying Suspicious Blockchain Transactions Using Clustering with Explainability"],"prefix":"10.1145","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3187-6131","authenticated-orcid":false,"given":"Jeyakumar","family":"Samantha Tharani","sequence":"first","affiliation":[{"name":"Computer Science, University of Jaffna, Jaffna, Sri Lanka and School of ICT, Griffith University, Gold Coast, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0678-3486","authenticated-orcid":false,"given":"Eugene Yugarajah Andrew","family":"Charles","sequence":"additional","affiliation":[{"name":"University of Jaffna, Jaffna, Sri Lanka"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4835-4556","authenticated-orcid":false,"given":"Punit","family":"Rathore","sequence":"additional","affiliation":[{"name":"Robert Bosch Centre for Cyberphysical Systems, IISC Bangalore, Bangalore, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7164-0580","authenticated-orcid":false,"given":"Zh\u00e9","family":"H\u00f3u\u00a0","sequence":"additional","affiliation":[{"name":"Griffith University, Gold Coast, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3635-4252","authenticated-orcid":false,"given":"Marimuthu","family":"Palaniswami","sequence":"additional","affiliation":[{"name":"The University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6787-6379","authenticated-orcid":false,"given":"Vallipuram","family":"Muthukkumarasamy","sequence":"additional","affiliation":[{"name":"Griffith University, Southport, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,10]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Cuneyt Gurcan Akcora Yitao Li Yulia R. Gel and Murat Kantarcioglu. 2019. BitcoinHeist: Topological data analysis for ransomware detection on the bitcoin blockchain. arXiv:1906.07852. Retrieved from https:\/\/arxiv.org\/abs\/1906.07852"},{"issue":"3","key":"e_1_3_2_3_2","doi-asserted-by":"crossref","first-page":"389","DOI":"10.3233\/IDA-140647","article-title":"Cluster ensemble selection based on a new cluster stability measure","volume":"18","author":"Alizadeh Hosein","year":"2014","unstructured":"Hosein Alizadeh, Behrouz Minaei-Bidgoli, and Hamid Parvin. 2014. Cluster ensemble selection based on a new cluster stability measure. Intelligent Data Analysis 18, 3 (2014), 389\u2013408.","journal-title":"Intelligent Data Analysis"},{"issue":"2","key":"e_1_3_2_4_2","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1145\/304181.304187","article-title":"OPTICS: Ordering points to identify the clustering structure","volume":"28","author":"Ankerst Mihael","year":"1999","unstructured":"Mihael Ankerst, Markus M. Breunig, Hans-Peter Kriegel, and J\u00f6rg Sander. 1999. OPTICS: Ordering points to identify the clustering structure. ACM SIGMOD Record 28, 2 (1999), 49\u201360.","journal-title":"ACM SIGMOD Record"},{"issue":"1","key":"e_1_3_2_5_2","first-page":"95","article-title":"Analysis of elbow, silhouette, Davies-Bouldin, Calinski-Harabasz, and Rand-Index evaluation on K-means algorithm for classifying flood-affected areas in Jakarta","volume":"7","author":"Ashari Ilham Firman","year":"2023","unstructured":"Ilham Firman Ashari, Eko Dwi Nugroho, Randi Baraku, Ilham Novri Yanda, Ridho Liwardana, et al. 2023. Analysis of elbow, silhouette, Davies-Bouldin, Calinski-Harabasz, and Rand-Index evaluation on K-means algorithm for classifying flood-affected areas in Jakarta. Journal of Applied Informatics and Computing 7, 1 (2023), 95\u2013103.","journal-title":"Journal of Applied Informatics and Computing"},{"key":"e_1_3_2_6_2","volume-title":"Mastering Blockchain","author":"Bashir Imran","year":"2017","unstructured":"Imran Bashir. 2017. Mastering Blockchain. Packt Publishing Ltd."},{"issue":"9","key":"e_1_3_2_7_2","first-page":"17","article-title":"EBK-means: A clustering technique based on elbow method and k-means in WSN","volume":"105","author":"Bholowalia Purnima","year":"2014","unstructured":"Purnima Bholowalia and Arvind Kumar. 2014. EBK-means: A clustering technique based on elbow method and k-means in WSN. International Journal of Computer Applications 105, 9 (2014), 17\u201324.","journal-title":"International Journal of Computer Applications"},{"issue":"2","key":"e_1_3_2_8_2","doi-asserted-by":"crossref","first-page":"93","DOI":"10.1145\/335191.335388","article-title":"LOF: Identifying density-based local outliers","volume":"29","author":"Breunig Markus M.","year":"2000","unstructured":"Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and J\u00f6rg Sander. 2000. LOF: Identifying density-based local outliers. ACM SIGMOD Record 29, 2 (2000), 93\u2013104.","journal-title":"ACM SIGMOD Record"},{"issue":"2","key":"e_1_3_2_9_2","doi-asserted-by":"crossref","first-page":"e6071","DOI":"10.1002\/cpe.6071","article-title":"CSS: Handling imbalanced data by improved clustering with stratified sampling","volume":"34","author":"Cao Lu","year":"2022","unstructured":"Lu Cao and Hong Shen. 2022. CSS: Handling imbalanced data by improved clustering with stratified sampling. Concurrency and Computation: Practice and Experience 34, 2 (2022), e6071.","journal-title":"Concurrency and Computation: Practice and Experience"},{"key":"e_1_3_2_10_2","first-page":"132","volume-title":"Proceedings of the European Conference on Computer Vision (ECCV)","author":"Caron Mathilde","year":"2018","unstructured":"Mathilde Caron, Piotr Bojanowski, Armand Joulin, and Matthijs Douze. 2018. Deep clustering for unsupervised learning of visual features. In Proceedings of the European Conference on Computer Vision (ECCV), 132\u2013149."},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/34.1000236"},{"key":"e_1_3_2_13_2","article-title":"Density-based spatial clustering of applications with noise","volume":"240","author":"Ester Martin","year":"1996","unstructured":"Martin Ester, Hans-Peter Kriegel, J\u00f6rg Sander, and Xiaowei Xu. 1996. Density-based spatial clustering of applications with noise. Int. Conf. knowledge Discovery and Data Mining 240 (1996).","journal-title":"Int. Conf. knowledge Discovery and Data Mining"},{"issue":"5","key":"e_1_3_2_14_2","doi-asserted-by":"crossref","first-page":"1798","DOI":"10.1093\/rfs\/hhz015","article-title":"Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies","volume":"32","author":"Foley Sean","year":"2019","unstructured":"Sean Foley, Jonathan R. Karlsen, and T\u0101lis J. Putni\u0146\u0161. 2019. Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies? The Review of Financial Studies 32, 5 (2019), 1798\u20131853.","journal-title":"The Review of Financial Studies"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.bcra.2022.100067"},{"key":"e_1_3_2_16_2","first-page":"1","article-title":"Inductive representation learning on large graphs","volume":"30","author":"Hamilton Will","year":"2017","unstructured":"Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems 30 (2017), 1\u201311.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-017-4396-4"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3211933.3211947"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","unstructured":"Samantha Jeyakumar Zh\u00e9 H\u00f3u Eugene Yugarajah Andrew Charles Marimuthu Palaniswami and Vallipuram Muthukkumarasamy. 2023. Visualizing Blockchain Transaction Behavioural Pattern: A Graph-based Approach. DOI: 10.36227\/techrxiv.22329889.v1","DOI":"10.36227\/techrxiv.22329889.v1"},{"key":"e_1_3_2_20_2","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1007\/978-981-97-0006-6_4","volume-title":"Distributed Ledger Technology","author":"Jeyakumar Samantha Tharani","year":"2024","unstructured":"Samantha Tharani Jeyakumar, Eugene Yugarajah Andrew Charles, Zh\u00e9 H\u00f3u, and Vallipuram Muthukkumarasamy. 2024. Detecting malicious blockchain transactions using graph neural networks. In Distributed Ledger Technology, Naipeng Dong, Babu Pillai, Guangdong Bai, and Mark Utting (Eds.), Springer Nature Singapore, Singapore, 55\u201371."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-30164-8_425"},{"key":"e_1_3_2_22_2","first-page":"413","volume-title":"Proceedings of the 2008 8th IEEE International Conference on Data Mining","author":"Liu Fei Tony","year":"2008","unstructured":"Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. 2008. Isolation Forest. In Proceedings of the 2008 8th IEEE International Conference on Data Mining, 413\u2013422. DOI: 10.1109\/ICDM.2008.17"},{"key":"e_1_3_2_23_2","first-page":"4768","volume-title":"Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS \u201917)","author":"Lundberg Scott M.","year":"2017","unstructured":"Scott M. Lundberg and Su-In Lee. 2017. A unified approach to interpreting model predictions. In Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS \u201917). Curran Associates Inc., Red Hook, NY, USA, 4768\u20134777."},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1002\/spy2.192"},{"key":"e_1_3_2_25_2","unstructured":"Aaron F. McDaid Derek Greene and Neil Hurley. 2013. Normalized Mutual Information to evaluate overlapping community finding algorithms. arXiv:1110.2515. Retrieved from https:\/\/arxiv.org\/abs\/1110.2515"},{"key":"e_1_3_2_26_2","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1109\/ISSA.2016.7802939","volume-title":"Proceedings of the 2016 Information Security for South Africa (ISSA)","author":"Monamo Patrick","year":"2016","unstructured":"Patrick Monamo, Vukosi Marivate, and Bheki Twala. 2016. Unsupervised learning for robust bitcoin fraud detection. In Proceedings of the 2016 Information Security for South Africa (ISSA). IEEE, 129\u2013134."},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102940"},{"key":"e_1_3_2_28_2","first-page":"1","article-title":"On spectral clustering: Analysis and an algorithm","volume":"14","author":"Ng Andrew","year":"2001","unstructured":"Andrew Ng, Michael Jordan, and Yair Weiss. 2001. On spectral clustering: Analysis and an algorithm. In Advances in Neural Information Processing Systems 14 (2001), 1\u20138.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05345-1_14"},{"key":"e_1_3_2_30_2","unstructured":"Thai Pham and Steven Lee. 2016. 2016. Anomaly detection in the Bitcoin system\u2014A network perspective. arXiv:1611.03942. Retrieved from https:\/\/arxiv.org\/abs\/1611.03942"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.3390\/s20010147"},{"key":"e_1_3_2_32_2","first-page":"155","volume-title":"Proceedings of the 2021 3rd International Conference on Blockchain Technology (ICBCT \u201921)","author":"Qin Rizhen","year":"2021","unstructured":"Rizhen Qin, Lihua Zhao, Da Li, Ke Yang, Jiaxing Xuan, and Hejian Wang. 2021. Research on design and application of power dispatch based on blockchain. In Proceedings of the 2021 3rd International Conference on Blockchain Technology (ICBCT \u201921). ACM, New York, NY, 155\u2013162. DOI: 10.1145\/3460537.3460564"},{"key":"e_1_3_2_33_2","first-page":"6","volume-title":"Financial Cryptography and Data Security","author":"Ron Dorit","year":"2013","unstructured":"Dorit Ron and Adi Shamir. 2013. Quantitative analysis of the full bitcoin transaction graph. In Financial Cryptography and Data Security. Ahmad-Reza Sadeghi (Ed.), Springer, Berlin, 6\u201324."},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04277-5_18"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSAA49011.2020.00096"},{"issue":"1","key":"e_1_3_2_36_2","first-page":"1","article-title":"A quantitative discriminant method of elbow point for the optimal number of clusters in clustering algorithm","volume":"2021","author":"Shi Congming","year":"2021","unstructured":"Congming Shi, Bingtao Wei, Shoulin Wei, Wen Wang, Hai Liu, and Jialei Liu. 2021. A quantitative discriminant method of elbow point for the optimal number of clusters in clustering algorithm. EURASIP Journal on Wireless Communications and Networking 2021, 1 (2021), 1\u201316.","journal-title":"EURASIP Journal on Wireless Communications and Networking"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","unstructured":"Priyanshi Singh Deepika Agrawal and Sudhakar Pandey. 2023. Anomaly detection and analysis in blockchain systems. Research Square. DOI: 10.21203\/rs.3.rs-2414745\/v1","DOI":"10.21203\/rs.3.rs-2414745\/v1"},{"key":"e_1_3_2_38_2","first-page":"427","volume-title":"Proceedings of the 2021 IEEE 46th Conference on Local Computer Networks (LCN)","author":"Jeyakumar Samantha Tharani","year":"2021","unstructured":"Samantha Tharani Jeyakumar, Eugene Yougarajah Andrew Charles, Zh\u00e9 H\u00f3u, Marimuthu Palaniswami, and Vallipuram Muthukkumarasamy. 2021. Graph based visualisation techniques for analysis of blockchain transactions. In. Proceedings of the 2021 IEEE 46th Conference on Local Computer Networks (LCN). IEEE, 427\u2013430."},{"key":"e_1_3_2_39_2","doi-asserted-by":"crossref","first-page":"8924","DOI":"10.1109\/TIFS.2024.3412421","article-title":"Unified feature engineering for detection of malicious entities in blockchain networks","author":"Jeyakumar Samantha Tharani","year":"2024","unstructured":"Samantha Tharani Jeyakumar, Eugene Yougarajah Andrew Charles, Zh\u00e9 H\u00f3u, Punit Rathore, Marimuthu Palaniswami, and Vallipuram Muthukkumarasamy. 2024. Unified feature engineering for detection of malicious entities in blockchain networks. IEEE Transactions on Information Forensics & Security 19 (2024), 8924\u20138938.","journal-title":"IEEE Transactions on Information Forensics & Security"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3238412"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2019.2895123"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2021.3049278"},{"issue":"2","key":"e_1_3_2_43_2","doi-asserted-by":"crossref","first-page":"1156","DOI":"10.1109\/TSMC.2020.3016821","article-title":"Who are the phishers? Phishing scam detection on Ethereum via network embedding","volume":"52","author":"Wu Jiajing","year":"2022","unstructured":"Jiajing Wu, Qi Yuan, Dan Lin, Wei You, Weili Chen, Chuan Chen, and Zibin Zheng. 2022. Who are the phishers? Phishing scam detection on Ethereum via network embedding. IEEE Transactions on Systems, Man, and Cybernetics: Systems 52, 2 (2022), 1156\u20131166.","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics: Systems"},{"key":"e_1_3_2_44_2","unstructured":"Junyuan Xie Ross Girshick and Ali Farhadi. 2015. Unsupervised deep embedding for clustering analysis. arXiv:1511.06335. Retrieved from https:\/\/arxiv.org\/abs\/1511.06335"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2018.2854904"},{"key":"e_1_3_2_46_2","doi-asserted-by":"crossref","first-page":"5996","DOI":"10.1109\/MACE.2011.5988401","volume-title":"Proceedings of the 2011 Second International Conference on Mechanic Automation and Control Engineering","author":"Zhang Huan","year":"2011","unstructured":"Huan Zhang and Kun Song. 2011. Research and experiment on affinity propagation clustering algorithm. In Proceedings of the 2011 Second International Conference on Mechanic Automation and Control Engineering, 5996\u20135999. DOI: 10.1109\/MACE.2011.5988401"},{"key":"e_1_3_2_47_2","doi-asserted-by":"crossref","first-page":"101829","DOI":"10.1016\/j.sysarc.2020.101829","article-title":"Anomaly detection in bitcoin information networks with multi-constrained meta path","volume":"110","author":"Zhang Rui","year":"2020","unstructured":"Rui Zhang, Guifa Zhang, Lan Liu, Chen Wang, and Shaohua Wan. 2020. Anomaly detection in bitcoin information networks with multi-constrained meta path. Journal of Systems Architecture 110 (2020), 101829.","journal-title":"Journal of Systems Architecture"},{"issue":"1","key":"e_1_3_2_48_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3408318","article-title":"Gaussian mixture model clustering with incomplete data","volume":"17","author":"Zhang Yi","year":"2021","unstructured":"Yi Zhang, Miaomiao Li, Siwei Wang, Sisi Dai, Lei Luo, En Zhu, Huiying Xu, Xinzhong Zhu, Chaoyun Yao, and Haoran Zhou. 2021. Gaussian mixture model clustering with incomplete data. ACM Transactions on Multimedia Computing, Communications, and Applications 17, 1s (2021), 1\u201314.","journal-title":"ACM Transactions on Multimedia Computing, Communications, and Applications"}],"container-title":["Distributed Ledger Technologies: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3773277","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T06:29:30Z","timestamp":1781159370000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3773277"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,10]]},"references-count":47,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2026,12,31]]}},"alternative-id":["10.1145\/3773277"],"URL":"https:\/\/doi.org\/10.1145\/3773277","relation":{},"ISSN":["2769-6480","2769-6480"],"issn-type":[{"value":"2769-6480","type":"print"},{"value":"2769-6480","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,10]]},"assertion":[{"value":"2024-06-20","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-06","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-06-10","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}